@sovovs/bycli 2.1.15 → 2.1.17

package/dist/src/download/article-download.js

@@ -5,6 +5,7 @@
  *
  * Flow: ArticleData → TurndownService → image download → frontmatter → .md file
  */
+import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import TurndownService from 'turndown';
@@ -238,11 +239,38 @@ function defaultDetectImageExt(url) {
     const extMatch = url.match(/\.(\w{3,4})(?:\?|$)/);
     return extMatch ? extMatch[1] : 'jpg';
 }
+/** Random 8-char lowercase hex segment used in downloaded image filenames. */
+function randomImageId() {
+    return crypto.randomBytes(4).toString('hex');
+}
+/**
+ * Build a collision-free `img_<8 hex>.<ext>` filename inside `imgDir`.
+ *
+ * `taken` guards against collisions between images downloaded concurrently in
+ * the same run, since those files do not exist on disk yet when the name is
+ * picked. The on-disk check covers files from earlier runs into the same dir.
+ */
+function buildImageFilename(imgDir, ext, taken) {
+    for (let attempt = 0; attempt < 10; attempt++) {
+        const filename = `img_${randomImageId()}.${ext}`;
+        if (taken.has(filename))
+            continue;
+        if (fs.existsSync(path.join(imgDir, filename)))
+            continue;
+        taken.add(filename);
+        return filename;
+    }
+    // Astronomically unlikely; fall back to a longer id rather than overwriting.
+    const filename = `img_${randomImageId()}${randomImageId()}.${ext}`;
+    taken.add(filename);
+    return filename;
+}
 async function downloadImages(imgUrls, imgDir, headers, detectExt) {
     const urlMap = {};
     if (imgUrls.length === 0)
         return urlMap;
     const detect = detectExt || defaultDetectImageExt;
+    const takenFilenames = new Set();
     // Deduplicate image URLs
     const seen = new Set();
     const uniqueUrls = imgUrls.filter(url => {
@@ -253,13 +281,12 @@ async function downloadImages(imgUrls, imgDir, headers, detectExt) {
     });
     for (let i = 0; i < uniqueUrls.length; i += IMAGE_CONCURRENCY) {
         const batch = uniqueUrls.slice(i, i + IMAGE_CONCURRENCY);
-        const results = await Promise.all(batch.map(async (rawUrl, j) => {
-            const index = i + j + 1;
+        const results = await Promise.all(batch.map(async (rawUrl) => {
             let imgUrl = rawUrl;
             if (imgUrl.startsWith('//'))
                 imgUrl = `https:${imgUrl}`;
             const ext = detect(imgUrl);
-            const filename = `img_${String(index).padStart(3, '0')}.${ext}`;
+            const filename = buildImageFilename(imgDir, ext, takenFilenames);
             const filepath = path.join(imgDir, filename);
             try {
                 const result = await httpDownload(imgUrl, filepath, {
@@ -336,13 +363,20 @@ export async function downloadArticle(data, options) {
     // Shape: `# Title\n[> meta\n...]\n---\n\n<markdown>` — exactly one blank
     // line separates every section, so we never produce ≥3 consecutive newlines.
     const headerValue = (value) => secureMarkdown ? escapeMarkdownText(value) : value;
+    // The source URL must not go through escapeMarkdownText: escaping `. _ - ( ) #`
+    // and entity-encoding `&` leaves a link that can no longer be copied or
+    // followed. safeHttpUrl already allowlists http(s) and percent-encodes `<`/`>`
+    // via URL normalization, so the autolink cannot be closed early; an empty
+    // return means a hostile or malformed URL and the line is dropped entirely.
+    const headerUrl = (value) => secureMarkdown ? safeHttpUrl(value) : value;
     const headerLines = [`# ${headerValue(data.title)}`];
     if (data.author)
         headerLines.push(`> ${labels.author}: ${headerValue(data.author)}`);
     if (data.publishTime)
         headerLines.push(`> ${labels.publishTime}: ${headerValue(data.publishTime)}`);
-    if (data.sourceUrl)
-        headerLines.push(`> ${labels.sourceUrl}: ${headerValue(data.sourceUrl)}`);
+    const sourceUrl = data.sourceUrl ? headerUrl(data.sourceUrl) : '';
+    if (sourceUrl)
+        headerLines.push(`> ${labels.sourceUrl}: <${sourceUrl}>`);
     const frontmatter = headerLines.join('\n') + '\n\n---\n\n';
     const fullContent = frontmatter + markdown;
     const size = Buffer.byteLength(fullContent, 'utf-8');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sovovs/bycli",
-  "version": "2.1.15",
+  "version": "2.1.17",
   "publishConfig": {
     "access": "public"
   },

package/dist/src/browser/extension-version-metadata.test.d.ts

@@ -1 +0,0 @@
-export {};